We are setting up an Apache web server secured by a server certificate.<\/p>\n
The HTTP protocol uses plain text, which can easily be spied on. The HTTPS extension surrounds HTTP traffic in a protective SSL\/TLS layer, preventing snooping and ensuring that we are really talking to the server we entered in the URL. All data is sent encrypted. This still doesn\u2019t mean that the web server is secure, but it is the basis for secure HTTP traffic.<\/p>\n
First, we are going to enable the server to use SSL with a self-signed certificate. Afterwards, I will explain how to get an officially signed certificate. In order to perform this step, you need to control a domain and a webserver, which is being routed and thus accessible from the internet. In this tutorial, I am going to work with the example domain This whole series of tutorials is meant as a guide to a successful lab setup. The idea is to really, really understand Apache. This tutorial is a bit of an exception, as we need to be accessible from the internet in order to get the signed certificate. Later tutorials will return to the lab setup though.<\/p>\n The inner working of the SSL-\/TLS<\/em>-protocol is complex. The free OpenSSL Cookbook<\/em> by Ivan Risti\u0107 (see links below) explains this topic. His bigger work Bulletproof SSL and TLS<\/em>, which explains the trust relationships in great detail, is another good introduction. The minimal knowledge required can be found in this tutorial though.<\/p>\n When contacted by a client, an SSL server must use a signed certificate to identify itself. For a successful connection, the client must be familiar with the signing authority, which it does by checking the certificate chain from the server to the root certificate of the signing authority, also called the certificate authority. Officially signed certificates are acquired from a public (or private) provider whose root certificate is one the browser is familiar with.<\/p>\n The configuration of an SSL server therefore comprises of two steps: Obtaining an officially signed certificate and configuring the server. The configuration of the server is the more interesting and easier part, which is why we\u2019ll do that first. In doing so, we\u2019ll be using an unofficial certificate present on our system (at least if it\u2019s from the Debian family and the ssl-cert<\/em> package is installed).<\/p>\n The certificate and related key are located here:<\/p>\n The names of the files are an indication that this pair is one that shouldn\u2019t inspire confidence. The browser will then put up a warning about the certificate if it\u2019s being used for a server.<\/p>\n But they are perfectly fine for an initial attempt at configuration:<\/p>\nchristian-folini.ch<\/code>.<\/p>\nStep 1: Configuring a server using SSL\/TLS, but without an officially signed certificate<\/h3>\n
<\/a>\/etc\/ssl\/certs\/ssl-cert-snakeoil.pem<\/span><\/span>\n<\/a>\/etc\/ssl\/private\/ssl-cert-snakeoil.key<\/span><\/span><\/code><\/pre><\/div>\n<\/a><\/span>\n<\/a>ServerName<\/span> localhost<\/span>\n<\/a>ServerAdmin<\/span> root@localhost<\/span>\n<\/a>ServerRoot<\/span> \/apache<\/span>\n<\/a>User<\/span> www-data<\/span>\n<\/a>Group<\/span> www-data<\/span>\n<\/a><\/span>\n<\/a>ServerTokens<\/span> Prod<\/span>\n<\/a>UseCanonicalName<\/span> On<\/span>\n<\/a>TraceEnable<\/span> Off<\/span>\n<\/a><\/span>\n<\/a>Timeout<\/span> 10<\/span>\n<\/a>MaxRequestWorkers<\/span> 100<\/span>\n<\/a><\/span>\n<\/a>Listen<\/span> 127.0.0.1:80<\/span>\n<\/a>Listen<\/span> 127.0.0.1:443<\/span>\n<\/a><\/span>\n<\/a>LoadModule<\/span> mpm_event_module modules\/mod_mpm_event.so<\/span>\n<\/a>LoadModule<\/span> unixd_module modules\/mod_unixd.so<\/span>\n<\/a><\/span>\n<\/a>LoadModule<\/span> log_config_module modules\/mod_log_config.so<\/span>\n<\/a><\/span>\n<\/a>LoadModule<\/span> authn_core_module modules\/mod_authn_core.so<\/span>\n<\/a>LoadModule<\/span> authz_core_module modules\/mod_authz_core.so<\/span>\n<\/a><\/span>\n<\/a>LoadModule<\/span> ssl_module modules\/mod_ssl.so<\/span>\n<\/a>LoadModule<\/span> headers_module modules\/mod_headers.so<\/span>\n<\/a><\/span>\n<\/a>ErrorLogFormat<\/span> "[%{cu}t] [%-m:%-l] %-a %-L %M"<\/span><\/span>\n<\/a>LogFormat<\/span> "%h %l %u [%{%Y-%m-%d %H:%M:%S}t.%{usec_frac}t] <\/span>\\"<\/span>%r<\/span>\\"<\/span> %>s %b \\<\/span><\/span>\n<\/a>\\"<\/span>%{Referer}i<\/span>\\"<\/span> <\/span>\\"<\/span>%{User-Agent}i<\/span>\\"<\/span>"<\/span> combined<\/span>\n<\/a><\/span>\n<\/a>LogLevel<\/span> debug<\/span>\n<\/a>ErrorLog<\/span> logs\/error.log<\/span>\n<\/a>CustomLog<\/span> logs\/access.log combined<\/span>\n<\/a><\/span>\n<\/a>SSLCertificateKeyFile<\/span> \/etc\/ssl\/private\/ssl-cert-snakeoil.key<\/span>\n<\/a>SSLCertificateFile<\/span> \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem<\/span>\n<\/a><\/span>\n<\/a>SSLProtocol<\/span> All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1<\/span>\n<\/a>SSLCipherSuite<\/span> 'kEECDH+ECDSA kEECDH kEDH HIGH +SHA !aNULL !eNULL !LOW !MEDIUM \\<\/span><\/span>\n<\/a>!MD5 !EXP !DSS !PSK !SRP !kECDH !CAMELLIA !RC4'<\/span><\/span>\n<\/a>SSLHonorCipherOrder<\/span> On<\/span>\n<\/a><\/span>\n<\/a>SSLRandomSeed<\/span> startup file:\/dev\/urandom 2048<\/span>\n<\/a>SSLRandomSeed<\/span> connect builtin<\/span>\n<\/a><\/span>\n<\/a>DocumentRoot<\/span> \/apache\/htdocs<\/span>\n<\/a><\/span>\n<\/a><<\/span>Directory<\/span> \/><\/span><\/span>\n<\/a><\/span>\n<\/a> Require<\/span> all denied<\/span>\n<\/a><\/span>\n<\/a> Options<\/span> SymLinksIfOwnerMatch<\/span>\n<\/a><\/span>\n<\/a><<\/span>\/Directory<\/span>><\/span><\/span>\n<\/a><\/span>\n<\/a><<\/span>VirtualHost<\/span> 127.0.0.1:80><\/span><\/span>\n<\/a><\/span>\n<\/a> <<\/span>Directory<\/span> \/apache\/htdocs><\/span><\/span>\n<\/a><\/span>\n<\/a> Require<\/span> all granted<\/span>\n<\/a><\/span>\n<\/a> Options<\/span> None<\/span>\n<\/a><\/span>\n<\/a> <<\/span>\/Directory<\/span>><\/span><\/span>\n<\/a><\/span>\n<\/a><<\/span>\/VirtualHost<\/span>><\/span><\/span>\n<\/a><\/span>\n<\/a><<\/span>VirtualHost<\/span> 127.0.0.1:443><\/span><\/span>\n<\/a><\/span>\n<\/a> SSLEngine<\/span> On<\/span>\n<\/a><\/span>\n<\/a> Header<\/span> always set Strict-Transport-Security "max-age=31536000; includeSubDomains"<\/span> env=HTTPS<\/span>\n<\/a><\/span>\n<\/a>